Vyper Vested Claims

Description: The contract grants significant power to the owner, who can change the merkle root or rescue tokens at any time without restrictions. This creates a centralization risk where users must trust the owner not to abuse these privileges. Lines 159-165 (set_merkle_root) and lines 167-177 (rescue_tokens) grant powerful capabilities to the owner.

Impact: Users must trust that the owner will not:

1. Change the merkle root to exclude legitimate users

2. Rescue tokens that are meant to be claimed by users

Recommended Mitigation:

1. Implement a timelock mechanism for sensitive owner actions

2. Consider a multi-signature approach for critical functions

3. Add restrictions to the rescue_tokens function to ensure it can only rescue tokens that aren't allocated to users:

   @external

   def rescue_tokens(to: address, amount: uint256):

   self.onlyOwner()

   # Get the contract balance

   contract_balance: uint256 = extcall IERC20(self.token).balanceOf(self)

   # Get the total unclaimed amount (requires additional tracking)

   assert amount <= contract_balance - self.total_allocated_amount, "Cannot rescue allocated tokens"

   log TokensRescued(to, amount)

   _success: bool = extcall IERC20(self.token).transfer(to, amount)

   assert _success, "Transfer failed"